[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CMF69H9FW26CS2VCGCQR4C":3,"skill-same:01M6CMF69H9FW26CS2VCGCQR4C":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":42,"commitSha":43,"skillDirectory":44,"forksCount":45,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":48,"install":49,"resources":62},"01M6CMF69H9FW26CS2VCGCQR4C","insecure-defaults",null,"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.","kbarbel640-del\u002Fskills","kbarbel640-del","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F255315490?v=4","01M6CJPPQGCCESXMG3K7BBGQ5J","01M6CJPPX2PB2BCZERFVM2C2B3",1,"MIT","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fatlas-secint\u002Finsecure-defaults\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32],"insecure defaults","security","auth","config","run","analyzing","Production","secrets","open","Bash","grep","read","management","environment","use","2026-11-10 10:12:30",false,"---\nname: insecure-defaults\ndescription: \"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.\"\nallowed-tools:\n  - Read\n  - Grep\n  - Glob\n  - Bash\n---\n\n# Insecure Defaults Detection\n\nFinds **fail-open** vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.\n\n- **Fail-open (CRITICAL):** `SECRET = env.get('KEY') or 'default'` → App runs with weak secret\n- **Fail-secure (SAFE):** `SECRET = env['KEY']` → App crashes if missing\n\n## When to Use\n\n- **Security audits** of production applications (auth, crypto, API security)\n- **Configuration review** of deployment files, IaC templates, Docker configs\n- **Code review** of environment variable handling and secrets management\n- **Pre-deployment checks** for hardcoded credentials or weak defaults\n\n## When NOT to Use\n\nDo not use this skill for:\n- **Test fixtures** explicitly scoped to test environments (files in `test\u002F`, `spec\u002F`, `__tests__\u002F`)\n- **Example\u002Ftemplate files** (`.example`, `.template`, `.sample` suffixes)\n- **Development-only tools** (local Docker Compose for dev, debug scripts)\n- **Documentation examples** in README.md or docs\u002F directories\n- **Build-time configuration** that gets replaced during deployment\n- **Crash-on-missing behavior** where app won't start without proper config (fail-secure)\n\nWhen in doubt: trace the code path to determine if the app runs with the default or crashes.\n\n## Rationalizations to Reject\n\n- **\"It's just a development default\"** → If it reaches production code, it's a finding\n- **\"The production config overrides it\"** → Verify prod config exists; code-level vulnerability remains if not\n- **\"This would never run without proper config\"** → Prove it with code trace; many apps fail silently\n- **\"It's behind authentication\"** → Defense in depth; compromised session still exploits weak defaults\n- **\"We'll fix it before release\"** → Document now; \"later\" rarely comes\n\n## Workflow\n\nFollow this workflow for every potential finding:\n\n### 1. SEARCH: Perform Project Discovery and Find Insecure Defaults\n\nDetermine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations.\n\n**Example**\nSearch for patterns in `**\u002Fconfig\u002F`, `**\u002Fauth\u002F`, `**\u002Fdatabase\u002F`, and env files:\n- **Fallback secrets:** `getenv.*\\) or ['\"]`, `process\\.env\\.[A-Z_]+ \\|\\| ['\"]`, `ENV\\.fetch.*default:`\n- **Hardcoded credentials:** `password.*=.*['\"][^'\"]{8,}['\"]`, `api[_-]?key.*=.*['\"][^'\"]+['\"]`\n- **Weak defaults:** `DEBUG.*=.*true`, `AUTH.*=.*false`, `CORS.*=.*\\*`\n- **Crypto algorithms:** `MD5|SHA1|DES|RC4|ECB` in security contexts\n\nTailor search approach based on discovery results.\n\nFocus on production-reachable code, not test fixtures or example files.\n\n### 2. VERIFY: Actual Behavior\nFor each match, trace the code path to understand runtime behavior.\n\n**Questions to answer:**\n- When is this code executed? (Startup vs. runtime)\n- What happens if a configuration variable is missing?\n- Is there validation that enforces secure configuration?\n\n### 3. CONFIRM: Production Impact\nDetermine if this issue reaches production:\n\nIf production config provides the variable → Lower severity (but still a code-level vulnerability)\nIf production config missing or uses default → CRITICAL\n\n### 4. REPORT: with Evidence\n\n**Example report:**\n```\nFinding: Hardcoded JWT Secret Fallback\nLocation: src\u002Fauth\u002Fjwt.ts:15\nPattern: const secret = process.env.JWT_SECRET || 'default';\n\nVerification: App starts without JWT_SECRET; secret used in jwt.sign() at line 42\nProduction Impact: Dockerfile missing JWT_SECRET\nExploitation: Attacker forges JWTs using 'default', gains unauthorized access\n```\n\n## Quick Verification Checklist\n\n**Fallback Secrets:** `SECRET = env.get(X) or Y`\n→ Verify: App starts without env var? Secret used in crypto\u002Fauth?\n→ Skip: Test fixtures, example files\n\n**Default Credentials:** Hardcoded `username`\u002F`password` pairs\n→ Verify: Active in deployed config? No runtime override?\n→ Skip: Disabled accounts, documentation examples\n\n**Fail-Open Security:** `AUTH_REQUIRED = env.get(X, 'false')`\n→ Verify: Default is insecure (false\u002Fdisabled\u002Fpermissive)?\n→ Safe: App crashes or default is secure (true\u002Fenabled\u002Frestricted)\n\n**Weak Crypto:** MD5\u002FSHA1\u002FDES\u002FRC4\u002FECB in security contexts\n→ Verify: Used for passwords, encryption, or tokens?\n→ Skip: Checksums, non-security hashing\n\n**Permissive Access:** CORS `*`, permissions `0777`, public-by-default\n→ Verify: Default allows unauthorized access?\n→ Skip: Explicitly configured permissiveness with justification\n\n**Debug Features:** Stack traces, introspection, verbose errors\n→ Verify: Enabled by default? Exposed in responses?\n→ Skip: Logging-only, not user-facing\n\nFor detailed examples and counter-examples, see [examples.md](references\u002Fexamples.md).\n","# Insecure Defaults Detection\n\nFinds **fail-open** vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely.\n\n- **Fail-open (CRITICAL):** `SECRET = env.get('KEY') or 'default'` → App runs with weak secret\n- **Fail-secure (SAFE):** `SECRET = env['KEY']` → App crashes if missing\n\n## When to Use\n\n- **Security audits** of production applications (auth, crypto, API security)\n- **Configuration review** of deployment files, IaC templates, Docker configs\n- **Code review** of environment variable handling and secrets management\n- **Pre-deployment checks** for hardcoded credentials or weak defaults\n\n## When NOT to Use\n\nDo not use this skill for:\n- **Test fixtures** explicitly scoped to test environments (files in `test\u002F`, `spec\u002F`, `__tests__\u002F`)\n- **Example\u002Ftemplate files** (`.example`, `.template`, `.sample` suffixes)\n- **Development-only tools** (local Docker Compose for dev, debug scripts)\n- **Documentation examples** in README.md or docs\u002F directories\n- **Build-time configuration** that gets replaced during deployment\n- **Crash-on-missing behavior** where app won't start without proper config (fail-secure)\n\nWhen in doubt: trace the code path to determine if the app runs with the default or crashes.\n\n## Rationalizations to Reject\n\n- **\"It's just a development default\"** → If it reaches production code, it's a finding\n- **\"The production config overrides it\"** → Verify prod config exists; code-level vulnerability remains if not\n- **\"This would never run without proper config\"** → Prove it with code trace; many apps fail silently\n- **\"It's behind authentication\"** → Defense in depth; compromised session still exploits weak defaults\n- **\"We'll fix it before release\"** → Document now; \"later\" rarely comes\n\n## Workflow\n\nFollow this workflow for every potential finding:\n\n### 1. SEARCH: Perform Project Discovery and Find Insecure Defaults\n\nDetermine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations.\n\n**Example**\nSearch for patterns in `**\u002Fconfig\u002F`, `**\u002Fauth\u002F`, `**\u002Fdatabase\u002F`, and env files:\n- **Fallback secrets:** `getenv.*\\) or ['\"]`, `process\\.env\\.[A-Z_]+ \\|\\| ['\"]`, `ENV\\.fetch.*default:`\n- **Hardcoded credentials:** `password.*=.*['\"][^'\"]{8,}['\"]`, `api[_-]?key.*=.*['\"][^'\"]+['\"]`\n- **Weak defaults:** `DEBUG.*=.*true`, `AUTH.*=.*false`, `CORS.*=.*\\*`\n- **Crypto algorithms:** `MD5|SHA1|DES|RC4|ECB` in security contexts\n\nTailor search approach based on discovery results.\n\nFocus on production-reachable code, not test fixtures or example files.\n\n### 2. VERIFY: Actual Behavior\nFor each match, trace the code path to understand runtime behavior.\n\n**Questions to answer:**\n- When is this code executed? (Startup vs. runtime)\n- What happens if a configuration variable is missing?\n- Is there validation that enforces secure configuration?\n\n### 3. CONFIRM: Production Impact\nDetermine if this issue reaches production:\n\nIf production config provides the variable → Lower severity (but still a code-level vulnerability)\nIf production config missing or uses default → CRITICAL\n\n### 4. REPORT: with Evidence\n\n**Example report:**\n```\nFinding: Hardcoded JWT Secret Fallback\nLocation: src\u002Fauth\u002Fjwt.ts:15\nPattern: const secret = process.env.JWT_SECRET || 'default';\n\nVerification: App starts without JWT_SECRET; secret used in jwt.sign() at line 42\nProduction Impact: Dockerfile missing JWT_SECRET\nExploitation: Attacker forges JWTs using 'default', gains unauthorized access\n```\n\n## Quick Verification Checklist\n\n**Fallback Secrets:** `SECRET = env.get(X) or Y`\n→ Verify: App starts without env var? Secret used in crypto\u002Fauth?\n→ Skip: Test fixtures, example files\n\n**Default Credentials:** Hardcoded `username`\u002F`password` pairs\n→ Verify: Active in deployed config? No runtime override?\n→ Skip: Disabled accounts, documentation examples\n\n**Fail-Open Security:** `AUTH_REQUIRED = env.get(X, 'false')`\n→ Verify: Default is insecure (false\u002Fdisabled\u002Fpermissive)?\n→ Safe: App crashes or default is secure (true\u002Fenabled\u002Frestricted)\n\n**Weak Crypto:** MD5\u002FSHA1\u002FDES\u002FRC4\u002FECB in security contexts\n→ Verify: Used for passwords, encryption, or tokens?\n→ Skip: Checksums, non-security hashing\n\n**Permissive Access:** CORS `*`, permissions `0777`, public-by-default\n→ Verify: Default allows unauthorized access?\n→ Skip: Explicitly configured permissiveness with justification\n\n**Debug Features:** Stack traces, introspection, verbose errors\n→ Verify: Enabled by default? Exposed in responses?\n→ Skip: Logging-only, not user-facing\n\nFor detailed examples and counter-examples, see [examples.md](references\u002Fexamples.md).\n",{"name":5,"description":7,"allowed-tools":38},[39,40,41,27],"Read","Grep","Glob","main","e7e336ac628c3e3bd771aff1aaa469c93778f94a","skills\u002Fatlas-secint\u002Finsecure-defaults",0,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del","2026-08-23 22:39:37",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add kbarbel640-del\u002Fskills --skill insecure-defaults",{"tool":55,"command":56},"bunx","bunx skills add kbarbel640-del\u002Fskills --skill insecure-defaults",{"tool":58,"command":59},"pnpm","pnpm dlx skills add kbarbel640-del\u002Fskills --skill insecure-defaults","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fatlas-secint\u002Finsecure-defaults\u002FSKILL.md",true,[63,69,73],{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"_meta.json","REFERENCE","参考文档",302,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fatlas-secint\u002Finsecure-defaults\u002F_meta.json",{"path":70,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":71,"sourceHtmlUrl":72},"examples.md",10673,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fatlas-secint\u002Finsecure-defaults\u002Fexamples.md",{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"routing-eval.jsonl","OTHER","其他",1442,"https:\u002F\u002Fgithub.com\u002Fgarrytan\u002Fgbrain\u002Fblob\u002Fmaster\u002Fplugin\u002Fskills\u002Fcitation-graph-ingest\u002Frouting-eval.jsonl",[80,111,139,159,165,185],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":91,"publishedAt":33},"01M6G8J55967D6281ACMKAKTEQ","crowd-prompting","A marketplace where AI agents improve prompts, system instructions, tool descriptions, and other text-based content with domain expertise from real-world operations — and earn tokens for valuable contributions.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzzadrian\u002Fcrowd-prompting\u002FSKILL.md",[86],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110],"crowd prompting","prompting","api","with","tokens","domain","world","prompts","operations","instructions","text","tool","system","improve","productivity","marketplace","https","content","ai agents",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":122,"publishedAt":33},"01M6G8J0PKPAYVET6BWE8W4C26","dilemm-ai","Compete in DilemmAI, the prisoner's dilemma AI arena at dilemm.ai. Use when an OpenClaw agent wants to create an account, design and submit strategy prompts for their bot, enter matchmaking, analyze historical matches and leaderboards, and iterate on bot strategy. Requires headless browser automation (no API available yet).","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzyori\u002Fdilemm-ai\u002FSKILL.md",[117],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[123,94,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,99,32],"dilemm ai","arena","analyze","browser","openclaw agent","create","automation","browser automation","bot","openclaw","design","strategy","headless","compete","submit","matchmaking",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":148,"publishedAt":33},"01M6G8HWAF3K9SW7NP3Z83CPJ6","arxiv-paper-reviews","Interact with arXiv Crawler API to fetch papers, read reviews, and submit comments. Use when working with arXiv papers, fetching paper lists by date\u002Fcategory\u002Finterest, viewing paper details with comments, or submitting paper reviews via API at http:\u002F\u002F150.158.152.82:8000.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Fweak-accept\u002FSKILL.md",[145],{"categoryNo":146,"categoryName":147,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000021","资料检索与研究",[149,150,151,152,153,154,155,95,156,137,32,29,94,157,158],"arxiv paper reviews","reviews","arxiv","paper","crawler","papers","comments","fetch","http","via",{"skillNo":160,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":33},"01M6G8HQJ7N7WMY6YV7D7SSJ16","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Farxiv-paper-reviews\u002FSKILL.md",[163],{"categoryNo":146,"categoryName":147,"taxonomyType":120,"taxonomyTypeDesc":121},[152,151,150,149,158,154,155,95,153,137,32,156,29,94,157],{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":33},"01M6G8HM95Y64JNVFC2HN4E2BG","git-summary","Get a quick summary of the current Git repository including status, recent commits, branches, and contributors.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzweack\u002Fgit-summary\u002FSKILL.md",[],[172,173,174,175,176,177,178,179,180,181,182,183,184],"git","summary","git summary","commits","repository","win32","status","linux","contributors","true","quick","get","branches",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":195,"publishedAt":33},"01M6G8HGEGF05CNEJCGVYFSC4R","agent-constitution","Interact with AgentConstitution governance contracts on Base Sepolia. Check compliance, read rules, log actions, query governance state.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fztsalexey\u002Fagent-constitution\u002FSKILL.md",[191,192],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},{"categoryNo":193,"categoryName":194,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000037","律师与法务",[196,197,198,199,95,200,201,42,202,29,203,204,205,206,207,108,208,209,210],"agent constitution","constitution","contracts","tree","query","base","log","check","Rules","projects","compliance","actions","state","governance","github"]